7863fc2b57f0048572950fea1e2f58368d69fcd261e9cb48f4473e3863475f42 | Triage

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 07:49

Sharing

Report Analysis Logs

General

Target

cd8242fb4fbac27568867c6dce767e44.exe
Size

28KB
MD5

cd8242fb4fbac27568867c6dce767e44
SHA1

bf1652190cfcaf8760d1720812c84a4dccd1c95d
SHA256

7863fc2b57f0048572950fea1e2f58368d69fcd261e9cb48f4473e3863475f42
SHA512

4a969205db129c2874531cb7cd48525a28641599954178479bed899c95ce591b68a5683b04dde0bf183c5070e5c892f4ecb63bee0b1cab14a36f5eaa3f051392
SSDEEP

768:/3f1M6bIznSBxhDM9tU5z0rKfHLOp1SkCg7Z3+:/3NM6MSDdM9y5z1rOS3g7Z3+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2944	2504	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2944	2504	cd8242fb4fbac27568867c6dce767e44.exe	28
PID 2504 wrote to memory of 2944	2504	cd8242fb4fbac27568867c6dce767e44.exe	28
PID 2504 wrote to memory of 2944	2504	cd8242fb4fbac27568867c6dce767e44.exe	28
PID 2504 wrote to memory of 2944	2504	cd8242fb4fbac27568867c6dce767e44.exe	28

C:\Users\Admin\AppData\Local\Temp\cd8242fb4fbac27568867c6dce767e44.exe
"C:\Users\Admin\AppData\Local\Temp\cd8242fb4fbac27568867c6dce767e44.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 116
  2⤵
  - Program crash
  PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2504-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2504-1-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2504-2-0x00000000002C0000-0x00000000002F0000-memory.dmp

Filesize
192KB

Download
memory/2504-3-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download